Continuous integrity attestation is vital for cloud providers to ensure the integrity of remote systems in a continuous manner. Current solutions, such as Keylime, rely on Trusted Platform Module (TPM) and Linux’s Integrity Measurement Architecture (IMA) but often struggle to balance minimizing false alerts and maintaining effective threat detection. In this paper, we examine common causes of attestation failures in Keylime through active experiments. We find that false positives often stem from unscheduled OS updates, and we propose a dynamic policy generation scheme as a solution (validated over 66 days of experiments). Our false negative experiments reveal vulnerabilities in existing designs, including five common issues across Keylime and IMA. Exploiting these issues, attackers could evade detection in all tested scenarios. Our findings offer insights into common failures of continuous integrity attestation, and our proposed solution is being integrated into Keylime with community support, enhancing cloud security. Our code will be available at https://github.com/mruffin/Dynamic-Policy-Generator.

Data preparation is the first and a very important step towards any Large Language Model (LLM) development. This paper introduces an easy-to-use, extensible, and scale-flexible open-source data preparation toolkit called Data Prep Kit (DPK). DPK is architected and designed to enable users to scale their data preparation to their needs. With DPK they can prepare data on a local machine or effortlessly scale to run on a cluster with thousands of CPU Cores. DPK comes with a highly scalable, yet extensible set of modules that transform natural language and code data. If the user needs additional transforms, they can be easily developed using extensive DPK support for transform creation. These modules can be used independently or pipelined to perform a series of operations. In this paper, we describe DPK architecture and show its performance from a small scale to a very large number of CPUs. The modules from DPK have been used for the preparation of Granite Models [1] [2]. We believe DPK is a valuable contribution to the AI community to easily prepare data to enhance the performance of their LLM models or to fine-tune models with Retrieval-Augmented Generation (RAG).

Wireless virtualization has emerged as one of the efficient ways to overcome numerous wireless networking challenges such as resource sharing by allowing multiple concurrent virtual wireless networks having run on shared physical wireless infrastructure. Spectrum sharing in wireless networks focuses on increasing the usage efficiency of radio frequency (RF) spectrum with its increasing demand. To reduce uncertainties that accompany the spectrum sharing process caused by RF sensing, database-based spectrum sharing allows opportunistic spectrum access through occupancy information query of a spectrum database. In this article, we propose a 2-level hierarchical spectrum allocation framework for multiple service-based virtual networks (VN) by leasing wireless resources from Wireless Infrastructure Providers (WIPs). The framework leverages the software defined network (SDN)-enabled virtualization where network parameters are configured based on the operating environment on the fly. This article focuses on the competition between multiple VNs to get best RF channels to serve their users while eliminating the need for one-to-one contracts between VNs and WIPs. We develop a mathematical model for the spectrum allocation scheme which allows heterogeneous network configurations with better economic benefit. Using network segments formed based on available sharable resources, the allocation scheme is localized which makes the scalability of this scheme possible. A trust-based security mechanism is also proposed for early detection and prevention of security attacks to maintain the availability attribute of the resource allocation process. Simulation results show that spectrum sharing is efficient, and assures service availability to perceived legitimate VN users.

Wireless virtualization is becoming a popular solution to resource sharing problems integral in providing access to future wireless networking applications by enabling access to the same physical wireless infrastructure by multiple virtual networks concurrently. This paper investigates cyber deception using game theory model for defining the deceptive interactions between a cyber attacker and the defender. We consider both the naive attacker who is not aware of the defender's strategy, and the rational (powerful) attacker who knows the defense strategy. In the Stackelberg game, the defender controls the observable configuration of the network when probed by an attacker. We show that the process for selecting an optimal defense strategy against a naive attacker is NP-hard. We also proposed an algorithm for computing optimal strategy for a naive attacker and a greedy based algorithm for selecting the optimal strategy against a powerful attacker. Results from extensive simulation runs show the scalability and effectiveness of the proposed approaches based on the run time in finding the optimum defense strategy as well as minimizing the attacker's utility are better than the approaches in state of the art literature.

Wireless virtualization has emerged as a technology of interest to overcome resource sharing problem by allowing multiple virtual networks to access the same physical wireless infrastructure concurrently based on service level agreements (SLAs). The main focus so far has been on improving the efficiency of wireless resource sharing process. From a security perspective, this technology and its variations have not commanded as much attention partly due to the early state of wireless virtualization development and the undefined nature of potential attacks. In this paper, we present a Deceptor-in-the-Middle (DitM) cyber-deception mechanism that leverages the wireless virtualization architecture to enable virtual network operators to learn about the interest and nature of attacks without the attacker being aware and also not compromising the security and quality of service requirements of the virtual network users. We also propose a detection mechanism for identifying the presence of an attacker and redirecting to deception virtual networks. The performance of the proposed approach is evaluated using numerical results obtained from Monte Carlo simulations. The numerical results signify that the proposed DitM results in higher throughput than that of without the deceptor. We also analyzed the DitM using different metrics including the probability of miss detection and false alarm.

With wireless virtualization, Wireless Infrastructure Providers (WIPs) are able to sublease out RF spectrum to multiple Wireless Virtual Network Operators (WVNO) who in turn offer services to their customers while sharing the same physical infrastructure. WVNOs are capable of leasing through a reservation process which may be accompanied by some strict guarantees, usually discouraging overbooking through certain penalties. On a global scale, it is important for WIPs to also be able to proactively reserve spectrum resources for consumer usage based on informed estimates. As part of the educated estimation, predictions are made from data of previous spectrum allocations and harmonized with aggregation of crowd-sourced data for events in a bid to reduce the probability of overbooking. The data aggregation effort relies on the the reliability of workers to generate highly accurate results using a community-based aggregation model. Also in this paper, a novel spectrum reservation prediction algorithm, namely Volume-conditioned Spectrum Selective Moving Average (VSSMA) is proposed using the trend similarity of spectrum allocation. The simulation results show that the relative mean error of the VSSMA algorithm is much lower than the Exponential Weighted Moving Average (EWMA) algorithm which is widely used now. We validate the desirable properties of the proposed approach through theoretical analysis, as well as simulations.

For enhancing the utilization of radio frequency (RF) bands, dynamic spectrum access has been considered to be an emerging paradigm where unlicensed secondary users access the licensed RF spectrum opportunistically without causing harmful interference to licensed primary users. In order to access idle channels, secondary users are required either to sense channels or search the geolocation based spectrum database before starting their actual communications. Note that the database searching approach has been proven to be more effective than the channel sensing approach since the sensing based approach results in higher sensing uncertainties. When a large number of secondary users query the spectrum database for finding idle channels at the same time, the spectrum server could be overwhelmed that could result in (unintentional) Denial-of-Service attack. In this paper, we investigate group-query-as- aservice for searching idle channels in database driven dynamic spectrum access where selected secondary users (aka grid leaders who are selected based on the interactive trust levels, location and resources in their grids) query on behalf of the other secondary users (aka grid followers). In this approach, secondary users are associated with the contours created based on same idle channels with the help of spectrum sensors and mobile edge computing (MEC) servers at each base station. The performance of the proposed group-query-as-a-service is evaluated using numerical results obtained from Monte Carlo simulation. We found that the proposed approach results in less delay with increase edge hit rate and higher throughput than the individual query based approach.